X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=blobdiff_plain;f=ng_selfservice%2Fpackages_change.php;h=6791a1ad20e719686c854c6356a38dc143c42977;hp=8b4386ce0c9db6ff74f339a91d1d81144ed71b08;hb=f73a37bd1dfd6f8e5cd497b8ac2843a7b8b1247b;hpb=3237b4cfdf3e507d5d4e04f2d3cf9b925d5ee953

diff --git a/ng_selfservice/packages_change.php b/ng_selfservice/packages_change.php
index 8b4386ce0..6791a1ad2 100644
--- a/ng_selfservice/packages_change.php
+++ b/ng_selfservice/packages_change.php
@@ -6,32 +6,24 @@ $customer_info = $freeside->customer_info_short( array(
   'session_id' => $_COOKIE['session_id'],
 ) );
 
-$list_pkgs = $freeside->list_pkgs( array(
-  'session_id' => $_COOKIE['session_id'],
-) );
+if ( preg_match( '/^(\d+)$/', $_GET['pkgnum'] ) ) {
+ $cust_pkg = $freeside->pkg_info( array(
+   'session_id' => $_COOKIE['session_id'],
+   'pkgnum' => $_GET['pkgnum'],
+ ) );
+}
+else { $cust_pkg['error'] = 'Bad Package Number'; }
 
-if ( isset($list_pkgs['error']) && $list_pkgs['error'] ) {
-  $error = $list_pkgs['error'];
+if ( isset($cust_pkg['error']) && $cust_pkg['error'] ) {
+  $error = $cust_pkg['error'];
   header('Location:index.php?error='. urlencode($error));
   die();
 }
 
-extract($list_pkgs);
-
-$get_params = array( 'pkgnum', 'pkg' );
-foreach ( $get_params AS $param ) {
-  $params[$param] = $_GET[$param];
-}
-
-$pkgnum = $_GET['pkgnum'];
-$pkg = $_GET['pkg'];
-
 $pkgselect = $freeside->mason_comp( array(
     'session_id' => $_COOKIE['session_id'],
     'comp'       => '/elements/select-part_pkg.html',
-    'args'       => array( 'custnum' => $customer_info['custnum'],
-                           'curr_value' => 'current_value',
-                    ),
+    'args'       => [ 'classnum', $cust_pkg['classnum'], 'curr_value', $cust_pkg['pkgpart'], ],
   )
 );
 
@@ -53,7 +45,7 @@ function enable_change_pkg () {
 }
 </SCRIPT>
 
-<FONT SIZE=4>Purchase replacement package for "<? echo $pkg; ?>"</FONT><BR><BR>
+<FONT SIZE=4>Purchase replacement package for "<? echo htmlspecialchars($cust_pkg['pkg_label']); ?>"</FONT><BR><BR>
 
 <? include('elements/error.php'); ?>
 
@@ -70,8 +62,7 @@ function enable_change_pkg () {
 </TABLE>
 <BR>
 <INPUT TYPE="hidden" NAME="custnum" VALUE="<? echo $customer_info['custnum'] ?>">
-<INPUT TYPE="hidden" NAME="pkgnum" VALUE="<? echo $params['pkgnum'] ?>">
-<INPUT TYPE="hidden" NAME="pkg" VALUE="<? echo $params['pkg'] ?>">
+<INPUT TYPE="hidden" NAME="pkgnum" VALUE="<? echo htmlspecialchars($_GET['pkgnum']) ?>">
 <INPUT TYPE="hidden" NAME="action" VALUE="process_change_pkg">
 <INPUT NAME="submit" TYPE="submit" VALUE="Change Package">
 </FORM>